how to get rid of this drone spammer

BuLB · none Joined: 28 Jan 2004 Posts: 20

recently we have problems on spammer that join channels and leave after it spam just like this one..

* freemanGrant (Grant@-382F7E4C.singnet.com.sg) has joined #cksc
<freemanGrant> i have big list of URL porn Movies at my private server..you can see while im online http://xxx.xxx.21.77:3322/
* freemanGrant (Grant@UAAP-382F7E4C.singnet.com.sg) Quit (Client exited)

lots of them going and coming back with time interval..anyone here can tell us how to fixed that and where in the ircd it will be change..we are using unrealircd..

phrozen77 · Posted: Sep 19, 2004 6:41am Post subject:

to be of any real help, guess we need a bit more information on that..

is it always the same / similar text? then you maybe should "fix" that using unreals built-in spamfilter (/helpop ?spamfilter) and / or take a look at Unreal Spamfilter Support Forum

what about the ip? is it always the same? same isp?[/url]

<edit>

and as i guess that the url he/she/it spams, is some sort of virus/malware, you maybe should change it a bit in your posting so that noone gets infected by chance...

</edit>

Ib3N · Lurker Joined: 10 Mar 2004 Posts: 157 Location: ChatSpike

contact the IRCDefender team with help to set regexp akills for those. We've managed to successfully to get rid of them all (all versions)

#defender or #chatspike @ irc.chatspike.net

Cobi · Lurker Joined: 30 Dec 2003 Posts: 121 Location: IRC

ehh... thought of the unreal ircd spam filter?
just add this in the unrealircd.conf file:

BuLB · none Joined: 28 Jan 2004 Posts: 20

nope they go on differnet msg and different spam url

BuLB · none Joined: 28 Jan 2004 Posts: 20

nope it have different ip and different spam msg and url..

w00t · Posted: Sep 21, 2004 5:33pm Post subject:

As Ib3n said, ircdefender (www.ircdefender.org) can more than likely rid you of these problems Smile

We use it, and it works quite well.

{edit}Fixed Ib3n's name Surprised

{/edit}

Pberetta · none Joined: 25 Sep 2003 Posts: 23

There is a patter in the masks of those spambots.
u could define it as ident isin nick

On our net we ban matching hosts for 35 seconds, enough to prvent spam, not to harsh on accidental hits
Mirc doesn't have an identifier for ident
the following line of script ill retrieve it

/set %_ident $remove($gettok($gettok($fulladdress,1,64),2,33),~)

a short example, using srvx, not to hard to adapt to other services

on *:join:#channel1,#channel2:{
/set %_ident $remove($gettok($gettok($fulladdress,1,64),2,33),~)
if ( %_ident isin $nick && ($nick != %_ident)) { /msg X ban $chan $address($nick,5) }
if ( %_ident isin $nick && ($nick != %_ident)) { notice $nick You have been banned from $chan for 1 minute because you have been detected as a possible spammer! If this is in error, simply wait til the ban is lifted and talk to an oper.
timer 1 35 { /msg X unban $chan $address($nick,5) }
}
else halt
}

Works perfect for us

Just my 2 cents

Cheers
Peer Ruis
Thundercity Netadmin

Ib3N · Lurker Joined: 10 Mar 2004 Posts: 157 Location: ChatSpike

Well thank you woot, how kind.. hehehe Wink

Pberetta · none Joined: 25 Sep 2003 Posts: 23

For teh techies among us
We are talkin about teh mymoon trojan here.

http://lists.blitzed.org/pipermail/ircd-checkins/2004-September/000617.html

seems a thread about a trap for bahamut developped by blitzed.

Also interesting if u need a nicklist for some reason

Pberetta
Netadmin Thundercity.Net

DeadNotBuried · none Joined: 01 Mar 2004 Posts: 43

if it's the mymoon and your running unreal, check out this thread on the unreal forums http://www.phpmemx.net/~unrealir/forums/viewtopic.php?t=905